Skip to content

Implement License Scanning SBOM scanner

Why are we doing this work

To achieve License Scanning using License DB and SBOM comp... (&9400 - closed), we need to implement a License Scanning SBOM Scanner that inherits LicenseScanning::BaseScanner, and that returns licenses of project dependencies using the SBOM reports.

NOTE: The SBOM Scanner is behind a feature flag. See Feature flag to enable License Scanning SBOM sc... (#384935 - closed)

Further details

The SbomScanner class has been introduced in !105747 (merged) but its methods haven't been implemented.

The SBOM scanner responds to report, has_data?, and data_available?. See #384934 (closed)

#report should do the following:

  1. Fetch projet dependencies for the given project or pipeline using SBOM component fetchers.
  2. TBD: Normalize component names, unless the SBOM component fetchers already do it. See #384932 (comment 1230139272)
  3. Get the licenses of package versions using another fetcher.
  4. Build and return a Ci::Reports::LicenseScanning::Report.

The SBOM scanner works even when the SBOM reports don't contain normalized component names. For instance, it should return the correct licenses for a component whose PURL is pkg:pypi/djanGO. (Canonical name is Django, and normalized name is django.)

#has_data? and #data_available? should behave as documented in !105533 (merged):

method description
#has_data? Evaluates if the scanner had license scanning data. In terms of the artifact scanner, it will evaluate to true if there was a job that returns a license_scanning report. For the SBoM scanner, this may materialize as having SBoM generator jobs.
#data_available? Evaluates if the scanner has completed "scanning". In terms of artifact scanning, this is determined if the pipeline with the license scanning report has a status of success.

PipelineComponents needs to be updated to return a name that can't be directly compared to pm_packages.name. It's normalized, and it includes the namespace (npm) or group ID (Maven). Code: #{component.purl.namespace}/#{component.purl.name} See #384932 (comment 1243704431)

Relevant links

Non-functional requirements

Implementation plan

  • Update PipelineComponents to return full normalized names. See #384932 (comment 1243704431)
  • Implement the SbomScanner, and update its specs.
  • Add a new license_scanning_sbom_scanner feature flag.

Verification steps

Check license_scanning_sbom_scanner feature flag. Enable license_scanning_sbom_scanner feature flag in a project where Dependency Scanning is used to generate SBOMs:

  1. Set up a project supported by Dependency Scanning and License DB.
  2. Enable feature flag for that project. See #384935 (closed)
  3. Add Dependency Scanning to the CI config, and add dependencies to project.
  4. Check licenses in License Compliance page.
  5. Check other features that have already been refactored as part of &8532 (closed).

Non-regression test

  • Go to a projet where License Scanning has been configured, and that has License Scanning artifacts.
  • Use any License Scanning feature that's been refactored as part of Use License Scanning service (&8532 - closed).
  • Make sure that there's no regression.

The verification tests are blocked by Feature flag to enable License Scanning SBOM sc... (#384935 - closed).

Also, check whether Licenses do not show up in Dependency List for ... (#333839 - closed) is fixed when enabling license_scanning_sbom_scanner. See !109447 (comment 1263301787)

Edited by Fabien Catteau